Missing Encryption of Sensitive Data Vulnerability in Apache Tomcat
CVE-2026-34486

7.5HIGH

Key Information:

Vendor: Apache
Status: Apache Tomcat
Vendor: CVE Published:; 9 April 2026

Badges

📈 Trended📈 Score: 8,190💰 Ransomware👾 Exploit Exists🟡 Public PoC🟣 EPSS 82%🦅 CISA Reported📰 News Worthy

What is CVE-2026-34486?

CVE-2026-34486 is a vulnerability identified in certain versions of Apache Tomcat, a widely used open-source application server for running Java Servlets and JavaServer Pages. This particular vulnerability stems from the missing encryption of sensitive data, which has arisen due to an adjustment made in response to a previous vulnerability (CVE-2026-29146). The modification inadvertently allows for the bypass of the EncryptInterceptor, a component responsible for ensuring that sensitive information is properly encrypted during processing. As such, organizations relying on affected versions of Apache Tomcat (specifically versions 11.0.20, 10.1.53, and 9.0.116) may face significant risks as sensitive data could be exposed to unauthorized access, leading to potential data breaches and compliance violations.

Potential impact of CVE-2026-34486

Data Exposure: The primary concern with CVE-2026-34486 is the risk of sensitive data being transmitted or stored in an unencrypted format, making it accessible to malicious actors. This could include personal information, credentials, and business-critical data, resulting in severe privacy violations.
Compliance Risks: Organizations that handle sensitive data are often subject to regulations (such as GDPR, HIPAA, etc.) requiring proper encryption standards. Failure to comply due to this vulnerability could lead to legal ramifications, including fines and sanctions, as well as damaging reputational impacts.
Increased Attack Surface: The nature of the vulnerability increases the attack surface for potential exploits. Attackers exploiting this flaw can gain unauthorized access to sensitive data or leverage it for further attacks, amplifying the risk of system compromise and broader network vulnerabilities.

CISA has reported CVE-2026-34486

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2026-34486 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace as recent news articles suggest the vulnerability is being used by ransomware groups.

The CISA's recommendation is: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Affected Version(s)

Apache Tomcat 11.0.20

Apache Tomcat 10.1.53

Apache Tomcat 9.0.116

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-34486
Created by striga-ai

CVE-2026-34486-poc
Created by AirSkye

CVE-2026-34486
Created by 404-src

News Articles

Techtimes

CVE-2026-34486 CVE-2026-9198

N-central's Incomplete Patch Left MSP Clients Exposed While Attackers Held Both Keys

N-able N-central vulnerability added to CISA’s Known Exploited Vulnerabilities catalog twice in one week -- covering both the original authentication bypass and its failed patch -- alongside Langflow

2 weeks ago

BleepingComputer

CVE-2026-34486

CISA warns of hackers exploiting Langflow, N-central, Apache Tomcat flaws

The U.S. Cybersecurity and Infrastructure Security Agency is giving federal agencies three days to mitigate vulnerabilities in IBM Langflow, N-central, and Apache Tomcat, all actively exploited.

2 weeks ago